redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

[PATCH] ibmasm: use after free fix 

The kobject_put() can free the memory at *cmd, but cmd->lock points to a
persistent lock that is not freed with cmd.

Signed-off-by: Max Asbock <masbock@us.ibm.com>
Cc: Vernon Mauery <vernux@us.ibm.com>
Cc: Srihari Vijayaraghavan <sriharivijayaraghavan@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
wifi-calibration
Max Asbock 2006-03-09 17:33:48 -08:00 committed by Linus Torvalds
parent a6bf527091
commit 6a88231fc7
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/misc/ibmasm/ibmasm.h
View File

@ -101,15 +101,16 @@ struct command {
static inline void command_put(struct command *cmd)
{
unsigned long flags;
spinlock_t *lock = cmd->lock;
spin_lock_irqsave(cmd->lock, flags);
kobject_put(&cmd->kobj);
spin_unlock_irqrestore(cmd->lock, flags);
spin_lock_irqsave(lock, flags);
kobject_put(&cmd->kobj);
spin_unlock_irqrestore(lock, flags);
}
static inline void command_get(struct command *cmd)
{
kobject_get(&cmd->kobj);
kobject_get(&cmd->kobj);
}